The city council wants a statement that ransomware detections are live. What should the analyst do first?
Select an answer to reveal the explanation.
Short Explanation
Installing ES is hanging the smoke detectors; it does not mean batteries and wiring are in every room. Before promising the council, check that the endpoint sourcetypes actually exist and are mapped. Coverage is a data question, not a slide-deck question.
Full Explanation
Before telling city council that ransomware detections are live, the analyst should check Security Essentials data-availability or Enterprise Security data-model completeness to confirm the required sourcetypes exist and are CIM-mapped. App installation alone does not equal detection capability; content without endpoint or related telemetry is theater for public officials. A documented data-availability check is the civic-honest statement council needs before claiming ransomware coverage.
Promising detections are live because the Enterprise Security app is installed confuses software presence with data readiness across municipal endpoints. Enabling every ransomware correlation search even if endpoint sourcetypes are absent creates empty or noisy content without evidence paths. Quoting last year's tabletop exercise as proof the detections have data confuses exercise outcomes with current telemetry health in Splunk.
Exam caveat: saying detections are live requires verified sourcetypes and CIM completeness, not merely Enterprise Security installed or a past tabletop.
Operational check: in Security Essentials open ransomware use cases, note required sources, verify they are present and mapped in Enterprise Security, sample recent endpoint malware events, then brief council with evidence-backed status and residual gaps.